en Copyright 2025 Java http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#5000d023a446b81f6d45ed59aa379607ec814f01 heimdal-kadmin: Add support for the -f dump optionThe "-f" dump option allows a dump of the HeimdalKDC in a format that the MIT kdb5_util command canload into a MIT KDC's database.This makes transitioning from the Heimdal KDC tothe current MIT one feasible without having tore-create the KDC database from scratch.glebius@ did the initial work, cherry picking thesecommits from the Heimdal sources on github and then doingextensive merge conflict resolution and other fixes sothat it would build.Heimdal commit fca5399 authored by Nico Williams:Initial commit for second approach for multiple kvno. NOT TESTED!Heimdal commit 57f1545 authored by Nico Williams:Add support for writing to KDB and dumping HDB to MIT KDB dump format Before this change Heimdal could read KDBs. Now it can write to them too. Heimdal can now also dump HDBs (including KDBs) in MIT format, which can then be imported with kdb5_util load. This is intended to help in migrations from MIT to Heimdal by allowing migrations from Heimdal to MIT so that it is possible to rollback from Heimdal to MIT should there be any issues. The idea is to allow a) running Heimdal kdc/kadmind with a KDB, or b) running Heimdal with an HDB converted from a KDB and then rollback by dumping the HDB and loading a KDB. Note that not all TL data types are supported, only two: last password change and modify-by. This is the minimum necessary. PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE, and for databases with K/M history we may need to add KRB5_TL_MKVNO support.This resulted in a Heimdal kadmin that would dumpthe KDC database in MIT format. However, therewere issues when this dump was loaded into thecurrent MIT KDC in FreeBSD current/15.0.The changes I did to make the dump more useful are listed below:When "-f MIT" is used for "kadmin -l dump" it writesthe dump out in MIT format. This dump format is understoodby the MIT kdb5_util command. The patch modifies the aboveso that the MIT KDC's master key keytab file can be providedas the argument to "-f" so that the principals are re-encrypted init. This allows any principal with at least one strong encryptiontype key to work without needing a change_password.The strong encryption types supported by the Heimdal KDC are:aes256-cts-hmac-sha1-96aes128-cts-hmac-sha1-96The issues my changes address are:- If there are weak encryption keys in a principal's entry, MIT's kadmin.local will report that the principcal's entry is incomplete or corrupted.- The keys are encrypted in Heimdal's master key. The "-d" option can be used on the "kadmin -l dump" to de-encrypt them, but the passwords will not work on the current MIT KDC.To try and deal with the above issues, this patch modied the above to:- Does not dump the weak keys.- Re-encrypts the strong keys in MIT's master key if the argument to "-f" is actually a filename which holds the MIT KDC's master key keytab and not "MIT".- For principals that only have weak keys, it generates a fake strong key. This key will not work on the MIT KDC, but the principal entry will work once a change_password is done to it.- It always generates a "modified_by" entry, faking one if not already present in the Heimdal KDC database. This was necessary, since the MIT kadmin will report that the principal entry is "incomplete or corrupted" without one.It also fixed a problem where "get principal" no longerworked after the initial patch was applied.A man page update will be done as a separate commit.I believe this commit is acceptable since the Heimdalsources are now essentially deprecated in favor of theMIT sources and that this new "-f" patch simplifiesthe transition to the MIT KDC.Discussed with: glebius, cyMFC after: 3 days List of files: /src/kerberos5/lib/libhdb/Makefile Sun, 05 Oct 2025 16:18:35 +0000 Rick Macklem <rmacklem@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#7e97c6adffde3bd6f60f042ed2603335c005c6a7 kerberos5: Fix the Heimdal pkgbase buildWhen LIB_PACKAGE was added, MIT Kerberos was updated to use it butHeimdal was not, so it still used PACKAGE=kerberos-lib. Since wedeleted kerberos-lib-all.ucl, this caused update-packages to failwhen WITHOUT_MITKRB5 is set.Change the Heimdal libraries to use LIB_PACKAGE by setting this inkerberos5/lib/Makefile.inc, and remove PACKAGE=kerberos-lib from theindividual Makefiles for each library. This means Heimdal gets thesame set of packages as MIT Kerberos, except for kerberos-kdc whichwe don't create for Heimdal.Fixes: 929f5966a9fd ("packages: Improve handling of -lib packages")Reported by: jlduranReviewed by: jlduran, cyDifferential Revision: https://reviews.freebsd.org/D52371 List of files: /src/kerberos5/lib/libhdb/Makefile Thu, 04 Sep 2025 13:53:02 +0000 Lexi Winter <ivy@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#1ac6ea8a0251243d34f0ede2315b8f2b4393080d kerberos5, libcom_err, others: append to LDFLAGS instead of replacingReviewed by: imp, emasteDifferential Revision: https://reviews.freebsd.org/D49548 List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 05 Apr 2025 21:18:35 +0000 Chuck Silvers <chs@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#e9ac41698b2f322d55ccf9da50a3596edb2c1800 Remove residual blank line at start of MakefileThis is a residual of the $FreeBSD$ removal.MFC After: 3 days (though I'll just run the command on the branches)Sponsored by: Netflix List of files: /src/kerberos5/lib/libhdb/Makefile Mon, 15 Jul 2024 04:46:32 +0000 Warner Losh <imp@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /src/kerberos5/lib/libhdb/Makefile Wed, 16 Aug 2023 17:55:03 +0000 Warner Losh <imp@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#7ee18f5aada07f03433504545c1b7bed91cbda82 heimdal: Do not build a redundant source fileHeimdal's lib/hdb/db3.c is only built if DB3 is enabled, i.e. #if HAVE_DB3.FreeBSD's bdb is DB1. Therefore the entire db3.c file is #ifdef'd out.Let's avoid building a file that results in a useless object file.MFC after: 1 week List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 01 Apr 2023 03:43:10 +0000 Cy Schubert <cy@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#6e4dbb7feff42275c3025dbc25d6ea6cce4e5fd7 pkgbase: split kerberos binaries and libsSummary:This allows installing packages that depend on kerberos librarieswithout pulling in all the binaries. It also moves libgssapi to runtimeto allow installing kerbereos libraries without adding a dependancy onthe large utilities package. It makes sense to put libgssapi in runtimerather than kerberos-lib since this is a plugin layer which is intendedto support any GSS-API mechanisms, not just kerberos.A good example of a package which uses kerberos libraries withoutneeding the kerberos utilities is sshd. This uses the kerberos GSS-APIlibraries to implement its GSSAPIAuthentication option.MFC after: 2 weeksSubscribers: impDifferential Revision: https://reviews.freebsd.org/D36028 List of files: /src/kerberos5/lib/libhdb/Makefile Fri, 29 Jul 2022 09:14:34 +0000 Doug Rabson <dfr@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#a30235a4c360c06bb57be1f10ae6866a71fb5622 pkgbase: Create a FreeBSD-kerberos packageThis allows users to install or not kerberos related utilitiesand libs.Differential Revision: https://reviews.freebsd.org/D31801 List of files: /src/kerberos5/lib/libhdb/Makefile Thu, 02 Sep 2021 04:09:15 +0000 Emmanuel Vadot <manu@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#e948d980f78dd2789060b46d3d03ba0d96b23b59 kerberos5: fix the WITH_OPENLDAP buildRestore WARNS to its former glory prior to the global WARNS change to fixthe build.MFC-after: 3 days List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 30 Jan 2021 06:07:17 +0000 Kyle Evans <kevans@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#40343be5a15d1f03f93bd2f04e2dff23af5e23d2 Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.This fixes build when com_err.h is not installed.PR: 234691MFC after: 1 week List of files: /src/kerberos5/lib/libhdb/Makefile Mon, 14 Jan 2019 06:34:54 +0000 Yoshihiro Takahashi <nyan@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#5000d023a446b81f6d45ed59aa379607ec814f01 heimdal-kadmin: Add support for the -f dump optionThe "-f" dump option allows a dump of the HeimdalKDC in a format that the MIT kdb5_util command canload into a MIT KDC's database.This makes transitioning from the Heimdal KDC tothe current MIT one feasible without having tore-create the KDC database from scratch.glebius@ did the initial work, cherry picking thesecommits from the Heimdal sources on github and then doingextensive merge conflict resolution and other fixes sothat it would build.Heimdal commit fca5399 authored by Nico Williams:Initial commit for second approach for multiple kvno. NOT TESTED!Heimdal commit 57f1545 authored by Nico Williams:Add support for writing to KDB and dumping HDB to MIT KDB dump format Before this change Heimdal could read KDBs. Now it can write to them too. Heimdal can now also dump HDBs (including KDBs) in MIT format, which can then be imported with kdb5_util load. This is intended to help in migrations from MIT to Heimdal by allowing migrations from Heimdal to MIT so that it is possible to rollback from Heimdal to MIT should there be any issues. The idea is to allow a) running Heimdal kdc/kadmind with a KDB, or b) running Heimdal with an HDB converted from a KDB and then rollback by dumping the HDB and loading a KDB. Note that not all TL data types are supported, only two: last password change and modify-by. This is the minimum necessary. PKINIT users may need to add support for KRB5_TL_USER_CERTIFICATE, and for databases with K/M history we may need to add KRB5_TL_MKVNO support.This resulted in a Heimdal kadmin that would dumpthe KDC database in MIT format. However, therewere issues when this dump was loaded into thecurrent MIT KDC in FreeBSD current/15.0.The changes I did to make the dump more useful are listed below:When "-f MIT" is used for "kadmin -l dump" it writesthe dump out in MIT format. This dump format is understoodby the MIT kdb5_util command. The patch modifies the aboveso that the MIT KDC's master key keytab file can be providedas the argument to "-f" so that the principals are re-encrypted init. This allows any principal with at least one strong encryptiontype key to work without needing a change_password.The strong encryption types supported by the Heimdal KDC are:aes256-cts-hmac-sha1-96aes128-cts-hmac-sha1-96The issues my changes address are:- If there are weak encryption keys in a principal's entry, MIT's kadmin.local will report that the principcal's entry is incomplete or corrupted.- The keys are encrypted in Heimdal's master key. The "-d" option can be used on the "kadmin -l dump" to de-encrypt them, but the passwords will not work on the current MIT KDC.To try and deal with the above issues, this patch modied the above to:- Does not dump the weak keys.- Re-encrypts the strong keys in MIT's master key if the argument to "-f" is actually a filename which holds the MIT KDC's master key keytab and not "MIT".- For principals that only have weak keys, it generates a fake strong key. This key will not work on the MIT KDC, but the principal entry will work once a change_password is done to it.- It always generates a "modified_by" entry, faking one if not already present in the Heimdal KDC database. This was necessary, since the MIT kadmin will report that the principal entry is "incomplete or corrupted" without one.It also fixed a problem where "get principal" no longerworked after the initial patch was applied.A man page update will be done as a separate commit.I believe this commit is acceptable since the Heimdalsources are now essentially deprecated in favor of theMIT sources and that this new "-f" patch simplifiesthe transition to the MIT KDC.Discussed with: glebius, cyMFC after: 3 days List of files: /src/kerberos5/lib/libhdb/Makefile Sun, 05 Oct 2025 16:18:35 +0000 Rick Macklem <rmacklem@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#7e97c6adffde3bd6f60f042ed2603335c005c6a7 kerberos5: Fix the Heimdal pkgbase buildWhen LIB_PACKAGE was added, MIT Kerberos was updated to use it butHeimdal was not, so it still used PACKAGE=kerberos-lib. Since wedeleted kerberos-lib-all.ucl, this caused update-packages to failwhen WITHOUT_MITKRB5 is set.Change the Heimdal libraries to use LIB_PACKAGE by setting this inkerberos5/lib/Makefile.inc, and remove PACKAGE=kerberos-lib from theindividual Makefiles for each library. This means Heimdal gets thesame set of packages as MIT Kerberos, except for kerberos-kdc whichwe don't create for Heimdal.Fixes: 929f5966a9fd ("packages: Improve handling of -lib packages")Reported by: jlduranReviewed by: jlduran, cyDifferential Revision: https://reviews.freebsd.org/D52371 List of files: /src/kerberos5/lib/libhdb/Makefile Thu, 04 Sep 2025 13:53:02 +0000 Lexi Winter <ivy@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#1ac6ea8a0251243d34f0ede2315b8f2b4393080d kerberos5, libcom_err, others: append to LDFLAGS instead of replacingReviewed by: imp, emasteDifferential Revision: https://reviews.freebsd.org/D49548 List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 05 Apr 2025 21:18:35 +0000 Chuck Silvers <chs@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#e9ac41698b2f322d55ccf9da50a3596edb2c1800 Remove residual blank line at start of MakefileThis is a residual of the $FreeBSD$ removal.MFC After: 3 days (though I'll just run the command on the branches)Sponsored by: Netflix List of files: /src/kerberos5/lib/libhdb/Makefile Mon, 15 Jul 2024 04:46:32 +0000 Warner Losh <imp@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /src/kerberos5/lib/libhdb/Makefile Wed, 16 Aug 2023 17:55:03 +0000 Warner Losh <imp@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#7ee18f5aada07f03433504545c1b7bed91cbda82 heimdal: Do not build a redundant source fileHeimdal's lib/hdb/db3.c is only built if DB3 is enabled, i.e. #if HAVE_DB3.FreeBSD's bdb is DB1. Therefore the entire db3.c file is #ifdef'd out.Let's avoid building a file that results in a useless object file.MFC after: 1 week List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 01 Apr 2023 03:43:10 +0000 Cy Schubert <cy@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#6e4dbb7feff42275c3025dbc25d6ea6cce4e5fd7 pkgbase: split kerberos binaries and libsSummary:This allows installing packages that depend on kerberos librarieswithout pulling in all the binaries. It also moves libgssapi to runtimeto allow installing kerbereos libraries without adding a dependancy onthe large utilities package. It makes sense to put libgssapi in runtimerather than kerberos-lib since this is a plugin layer which is intendedto support any GSS-API mechanisms, not just kerberos.A good example of a package which uses kerberos libraries withoutneeding the kerberos utilities is sshd. This uses the kerberos GSS-APIlibraries to implement its GSSAPIAuthentication option.MFC after: 2 weeksSubscribers: impDifferential Revision: https://reviews.freebsd.org/D36028 List of files: /src/kerberos5/lib/libhdb/Makefile Fri, 29 Jul 2022 09:14:34 +0000 Doug Rabson <dfr@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#a30235a4c360c06bb57be1f10ae6866a71fb5622 pkgbase: Create a FreeBSD-kerberos packageThis allows users to install or not kerberos related utilitiesand libs.Differential Revision: https://reviews.freebsd.org/D31801 List of files: /src/kerberos5/lib/libhdb/Makefile Thu, 02 Sep 2021 04:09:15 +0000 Emmanuel Vadot <manu@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#e948d980f78dd2789060b46d3d03ba0d96b23b59 kerberos5: fix the WITH_OPENLDAP buildRestore WARNS to its former glory prior to the global WARNS change to fixthe build.MFC-after: 3 days List of files: /src/kerberos5/lib/libhdb/Makefile Sat, 30 Jan 2021 06:07:17 +0000 Kyle Evans <kevans@FreeBSD.org> http://opengrok.net:8080/history/src/kerberos5/lib/libhdb/Makefile#40343be5a15d1f03f93bd2f04e2dff23af5e23d2 Use ${SRCTOP}/contrib/com_err/com_err.h instead of the installed com_err.h.This fixes build when com_err.h is not installed.PR: 234691MFC after: 1 week List of files: /src/kerberos5/lib/libhdb/Makefile Mon, 14 Jan 2019 06:34:54 +0000 Yoshihiro Takahashi <nyan@FreeBSD.org>